mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
cooper-oai
cb00a67569
## What changed Add `RuntimeAuthProvider` to resolve request authentication through the runtime auth manager. Support `dual_header` mode, which sends a bearer credential alongside `x-openai-agent-assertion`, and `assertion_only` mode, which uses `Authorization: AgentAssertion …`. Replace stale authentication headers and sign a fresh assertion for each request attempt. Propagate registration failures without falling back to credential-only authentication, preserving policy errors and classifying transport failures, rate limits, and server errors as transient. Add the disabled-by-default `features.runtime_agent_instances` configuration with independent `enabled` and `mode` settings, schema support, and structured override merging. Selecting a mode alone does not enable the feature. ## Testing Add coverage for both modes with API key and ChatGPT credentials, stale header replacement, fresh assertions, credential refresh without runtime replacement, registration failures, and configuration parsing and merging. GitOrigin-RevId: 9e93d25762600f0ff592c5248fe4c8c2c8182c8d
32 lines
1.0 KiB
Rust
32 lines
1.0 KiB
Rust
//! Configuration for runtime assertions; enabling the feature is separate from selecting its mode.
|
|
|
|
use crate::FeatureConfig;
|
|
use schemars::JsonSchema;
|
|
use serde::Deserialize;
|
|
use serde::Serialize;
|
|
|
|
#[derive(Serialize, Deserialize, Debug, Clone, Copy, Default, PartialEq, Eq, JsonSchema)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum RuntimeAuthMode {
|
|
/// Send the actor credential and a runtime assertion together during migration.
|
|
#[default]
|
|
DualHeader,
|
|
/// Send only the runtime assertion as the request credential.
|
|
AssertionOnly,
|
|
}
|
|
|
|
#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct RuntimeAgentInstancesConfigToml {
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub enabled: Option<bool>,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub mode: Option<RuntimeAuthMode>,
|
|
}
|
|
|
|
impl FeatureConfig for RuntimeAgentInstancesConfigToml {
|
|
fn enabled(&self) -> Option<bool> {
|
|
self.enabled
|
|
}
|
|
}
|